Cloud Security Architect: 2026-09-19

1. Exploring the new AWS Sign Up experience

   Wiz (Scott Piper), 2026-09-17. Read, 6 min.

   Scott Piper walks through AWS's redesigned sign-up flow, which creates three AWS accounts inside an AWS Organization. AWS attaches a $20 per month budget whose breach action applies a service control policy denying new workloads. The sandbox denies access to GuardDuty, Security Hub, Detective, Inspector, Macie and Access Analyzer, even the free features, and a resource control policy blocks principals outside the organization and denies sts:AssumeRole from any other account. To get production-grade logging, guardrails and vendor integrations, a team has to upgrade the account and be given access to the organization management account.

   Why it matters for this role: Update your account vending and landing zone guidance: an account created through the new flow sits in its own sandbox organization that denies GuardDuty, Security Hub, Detective, Inspector, Macie and Access Analyzer and blocks cross-account sts:AssumeRole. Such an account cannot be enrolled in your logging and guardrail baseline until it is upgraded and management account access is granted.

Cloud Security Architect